3 ms·

Until you will be able to install an alternative marketplace without an Apple account (a la browser-downloaded F-Droid .apk) I cannot find a purpose to this, es

Until you will be able to install an alternative marketplace without an Apple account (a la browser-downloaded F-Droid .apk) I cannot find a purpose to this, especially since you cannot publish the same app on multiple marketplaces

consumer451 3y ago
On the one hand, I see the appeal of getting away from a gatekeeper like Apple telling me what I can, and can't do, on my own device. On the other hand, it would be very cool to also be able to avoid companies like DJI forcing sideloading of their heavily obfuscated app [0], as is currently the deal on Android. Is there a way to accomplish both? [0] https://news.ycombinator.com/item?id=39438842 https://news.ycombinator.com/item?id=39438842
- duxup 3y ago
  That’s my concern too. I don’t like the situation with Apple, but I also am concerned about the ability for alternatives to be … a net positive for the user. Understandably we think of some good examples of folks acting in good faith but a lot of the people offering apps… won’t.
- mindslight 3y ago
  Proper sandboxing and effective security permissions. Third party code is inherently still a black box, especially when the bulk of the would be attacker's code is running on a server and never goes through Apple's review process. There is no way to tell the difference between an app that uploads all of a user's contacts to do a one time search, and one that backhauls and stores all those contacts for later nefarious purposes. (I believe) Apple came up with a rule to directly prohibit mass uploads to address this specific thing, but the cat and mouse dynamic remains. Ultimately users need to be able to deny apps permissions, based on what an app needs to do and how much a user wants to trust a company (by default, very little). Permissions need to be implemented such that apps are unaware they're being denied so they're unable to coerce users into enabling them. For example, "location access" needs to have the option of returning a virtual location that was set from a map.
  - deleted 3y ago
    [deleted]
- creativeSlumber 3y ago
  > On the other hand, it would be very cool to also be able to avoid companies like DJI forcing sideloading of their heavily obfuscated app [0], as is currently the deal on Android. > Is there a way to accomplish both? I think so, but this sounds like a different problem. The problem here is a app that is required to operate a device bought by a EU consumer. EU can have additional regulations on such apps that are required for using all the capabilities of a purchased device that focuses on security and data governance.
mk89 3y ago
I disagree. The purpose should be (1) no need for app developers to pay 30% to Apple, (2) bypassing whatever Apple claims to be mandatory (e.g., notarization, etc) to run on their, sorry, your device. None of this is currently possible. They pretended to have tackled some of it, but in reality it's gonna create just some very niche marketplace and say "hey look, you see, we made it possible". This is one of the biggest vendor lockins existing (for an app developer). Big companies won't spend several billion $ just to make you download their free app (and let's not forget that reinstalling or updates count as a new download).

consumer451 3y ago

On the one hand, I see the appeal of getting away from a gatekeeper like Apple telling me what I can, and can't do, on my own device. On the other hand, it would be very cool to also be able to avoid companies like DJI forcing sideloading of their heavily obfuscated app [0], as is currently the deal on Android. Is there a way to accomplish both? [0] https://news.ycombinator.com/item?id=39438842 https://news.ycombinator.com/item?id=39438842

duxup 3y ago
That’s my concern too. I don’t like the situation with Apple, but I also am concerned about the ability for alternatives to be … a net positive for the user. Understandably we think of some good examples of folks acting in good faith but a lot of the people offering apps… won’t.
mindslight 3y ago
Proper sandboxing and effective security permissions. Third party code is inherently still a black box, especially when the bulk of the would be attacker's code is running on a server and never goes through Apple's review process. There is no way to tell the difference between an app that uploads all of a user's contacts to do a one time search, and one that backhauls and stores all those contacts for later nefarious purposes. (I believe) Apple came up with a rule to directly prohibit mass uploads to address this specific thing, but the cat and mouse dynamic remains. Ultimately users need to be able to deny apps permissions, based on what an app needs to do and how much a user wants to trust a company (by default, very little). Permissions need to be implemented such that apps are unaware they're being denied so they're unable to coerce users into enabling them. For example, "location access" needs to have the option of returning a virtual location that was set from a map.
- deleted 3y ago
  [deleted]
creativeSlumber 3y ago
> On the other hand, it would be very cool to also be able to avoid companies like DJI forcing sideloading of their heavily obfuscated app [0], as is currently the deal on Android. > Is there a way to accomplish both? I think so, but this sounds like a different problem. The problem here is a app that is required to operate a device bought by a EU consumer. EU can have additional regulations on such apps that are required for using all the capabilities of a purchased device that focuses on security and data governance.

mk89 3y ago

I disagree. The purpose should be (1) no need for app developers to pay 30% to Apple, (2) bypassing whatever Apple claims to be mandatory (e.g., notarization, etc) to run on their, sorry, your device. None of this is currently possible. They pretended to have tackled some of it, but in reality it's gonna create just some very niche marketplace and say "hey look, you see, we made it possible". This is one of the biggest vendor lockins existing (for an app developer). Big companies won't spend several billion $ just to make you download their free app (and let's not forget that reinstalling or updates count as a new download).